CN103647641A - Deterministic key pre-distribution for mobile body sensor networks - Google Patents

Abstract

A wireless network (2, 150) for monitoring a patient includes a body sensor network (22, 24, 26, 172, 174, 176) that includes one or more wireless sensors (6, 8, 10, 12, 14, 16, 18, 20, 156, 158, 160, 162, 164, 166, 168, 170) operatively connected to the patient that collect and transfer information related to the patient's health to the wireless network (2, 150). A set-up server (4, 154) configures the one or more wireless sensors (6, 8, 10, 12, 14, 16, 18, 20, 156, 158, 160, 162, 164, 166, 168, 170) with keying material before the one or more sensors (6, 8, 10, 12, 14, 16, 18, 20, 156, 158, 160, 162, 164, 166, 168, 170) are deployed to the wireless network (2, 150). A base station (178, 180) distributes a key certificate to the one or more sensors (6, 8, 10, 12, 14, 16, 18, 20, 156, 158, 160, 162, 164, 166, 168, 170) associated with the body sensor network (22, 24, 26, 172, 174, 176), such that two sensors generate a unique pairwise key based at least in part upon the pre-distributed keying material and the key certificate distributed by the base station (178, 180).

Description

Preassignment certainty key for mobile body sensor networks

background of invention

Below relate to wireless network.It sets up aspect the secure communication of information in wireless body sensor networks special purposes.Yet, should be understood that, the present invention also can be applicable to provide safe communication between other wireless devices and other wireless repeaters.

Mobile body sensor networks (BSN) is paid close attention in medical applications, and is generally used for patient care and monitoring.BSN comprises data-collection nodes and comprises alternatively control node.Sensor node is battery powered, has limited computing capability and memory capacity, and depends on the intermittent wireless communication by radio frequency.Traditionally, large numbers of (for example thousands of) interoperable node is deployed in for example Medical Treatment Area of hospital, then by different means are spontaneous, is connected to form different non-connection BSN.BSN is comprised of the little subset (from 2 to 50 nodes) of all nodes conventionally, and for example these nodes have distributed patient independent in Medical Treatment Area.Priori, the size of BSN and membership are unknown: BSN node may just exist in BSN formation, or may be added and delete afterwards.The flexibility after BSN forms of some nodes is limited, different independent BSN internetwork roamings (Data Collection that for example user of service carries and control node that other nodes have high degree of flexibility and form in the same area of being everlasting, the transducer that individual wears, etc.).Some nodes may be unattended.The life-span of BSN is limited to a couple of days, several weeks, several months, etc.The life-span of sensor node typically will be longer than the life-span of BSN example.BSN is formed at public or disadvantageous region, in these regions, communicates by letter and may be monitored by lawless person, and sensor node is subject to catching and controlling of lawless person.Internodal the crosstalking of the BSN associated from different patients may be damaged the medical effect of perceived data.

To BSN, design has proposed to have equal challenging security constraint to these challenging operation requirements.Fail safe service for BSN comprises evaluation and communication security.Typically, cipher key management services provides and manages for meeting the basic security data of aforementioned fail safe service.It is all infeasible that the calculating of BSN sensor node and communication constraint make to use any Security solution based on public key cryptography.Special (ad hoc) attribute of BSN and the operation requirements of BSN make the typical online solution based on server also improper.

Key management based on cipher key pre-distribution scheme (KPS) is an option for BSN.Because the node of needs uniqueness is identified and Key Establishing, with BSN membership and size independently, applied strict requirement to the KPS for BSN.Yet existing KPS scheme is that function is limited for BSN.First, the wide cipher key pre-distribution of network does not provide enough fail safes or can not in BSN, manage.The second, usual KPS not only can not expand but also can not be managed in BSN.The 3rd, the KPS(of Blundo perfectly Secure Key Distribution for Dynamic Conferences. In Advances in Cryptology – CRYPTO ' 92, Springer-Verlag, Berlin, 1993, elasticity pp.471-486) and limited scalability are in memory capacity and the computing capability of sensor node.The 4th, random key preassignment does not provide good Connectivity Properties for having the BSN of limited number node.Finally, amtepe and the Yener certainty KPS(based on Combination Design theory combinatorial Design of Key Distribution Mechanisms for Wireless Sensor Networks. In Proc. of Computer Security – ESORICS, Springer-Verlag, LNCS 3193,2004, pp 293-308) for BSN, having can compatible Connectivity Properties and appropriate elasticity, but unique pairwise key is not provided.

The people such as Basagni ( secure pebblenets. In Proc. of the 2 ^ndaCM International Symposium on Mobile Ad Hoc Networking and Computing, pp.156-163. 2001) propose a kind of key managing project and by periodically updating by the group symmetric key of all the sensors nodes sharing, sensor communication is protected.This scheme is taked Anti-interference sensor and the wide connection management fabric of distributed sensor networks (DSN), and this is not also suitable for the interconnection that the extensive DSN of BSN(can be considered a plurality of BSN with abnormal operation and networking difference.Alternatively, BSN is considered as to a plurality of non-connection fractionation of extensive DSN).

The people such as Perrig ( sPINS:Security protocols for sensor networks. In Proc. of MOBICOM, 2001) proposition SPINS, i.e. a kind of security architecture designing for sensor network specially.In SPINS, a private key is shared in each sensor node and base station.Two sensor nodes can not directly be set up a private key.But they can be arranged private key as trusting third party with base station.In BSN, base station is in Key Establishing moment possibility non-availability.

The people such as Blundo propose to derive group key based on polynomial KPS.For each group of two users, the cipher key pre-distribution scheme of Blundo can be used to set up pairwise key in BSN.Server is set in finite field fqon generate randomly symmetrical binary λ order polynomial

, wherein qit is a large prime number that must be enough to supply encryption key.According to symmetry,

.It is each transducer that server is set ucalculate multinomial share (

) and distributed to each transducer u.Each transducer uthere is unique identifier.After deployment phase, for two nodes arbitrarily uwith v, node ucan be by estimation point vplace

calculate Public key

, and node vcan be by estimation point uplace

calculate same key

.

The elasticity α of the KPS of Blundo is α=λ+1, and assailant need to damage α transducer to can generate the not pairwise key of impaired transducer.Each sensor node urequire storage λ order polynomial share

, its memory space taking is

.Should be understood that, λ is limited to memory capacity available on transducer m, m>=λ+1 key.In pairwise key process of establishing, there is not communication overhead.In order to set up pairwise key, two sensor nodes need to be estimated the multinomial at the ID place of other sensor nodes.This requires f _q in carry out λ mould and take advantage of with λ mould and add computing, it may be arm and a leg in CPU transducer limited in one's ability.

The people such as Liu ( establishing pairwise keys in distributed sensor networks. In Proc. of the 10th ACM Conference on Computer and Communications Security (CCS), 2003, pp.52-61) introduced a kind of improvement algorithm of multinomial estimation, to adapt to not the restriction that the low bit CPU with divide instruction causes, thereby reduced the calculation requirement to transducer.This is by λ binary polynomial coefficient length is bitwise reduced to and by select shape as

's

realize.

The people such as Liu have proved can be by level coupling tindividual containing fq 'on λ binary polynomial share of coefficient generate tindividual part key comes compound

the key of bit, and can significantly not reduce fail safe, obtain

bit keys with containing fqon this key of generating of λ binary polynomial of coefficient there is similar entropy, wherein

. tindividual containing fq 'on λ binary polynomial of coefficient

joint set be called tpolynomial set

. uthe estimation of some place tpolynomial set after this be individual tpolynomial set share (t-polynomisl-set share).

The unfavorable aspect of this technology is, fq 'on multinomial can only supply at most q '-1(rather than q-1) individual transducer.Especially, combination in parallel fq 'on multinomial ( tpolynomial set) can only supply at most n '= q '-1 node.For example, for 8 bit CPU, q '=2 ⁸+ 1 provides optimum calculated performance, still, and maximum node number n 'therefore be 256.Still a character of establishment is, fq 'on each binary polynomial

thereby, tpolynomial set, anti-λ gangs up.By using based on polynomial KPS fq 'on multinomial number, qwith q 'be applied under the certain lower limit on λ, Factoring Polynomials technology can be applied to any this KPS.

A kind of imperfect design (BIBD) of balance be by vindividual different target is arranged into bin individual piece, each piece is just comprised kindividual different target, each target just appears at rin individual different piece, and every pair of different target just appears at together tin individual piece.This design can be expressed as ( v, k, t), or of equal value being expressed as ( v, b, r, k, t), in formula t( v-1)= r( k-1) and bk= vr.

At symmetrical BIBD(SPIBD) in, b= vthereby, k= r.SPIBD has four character: each piece comprises k= rindividual element; Each element appears at k= rin individual piece; Every pair of element appears at tin individual piece; And every pair of piece exists ton individual element, intersect.

Given have | s|= vthe S set of individual target and | b|= bthe set of individual piece

piece design d=( v, k, t), wherein each piece just comprises kindividual target, so for 1≤ i≤ b, complementary design

with complementary block

as its piece. be have parameter ( v, b, b- r, v- k, b-2 r+ t) BIBD, wherein b-2 r+ t>0.If d=( v, k, t) be a SBIBD, so

also be a SBIBD.

Finite projection plane (FPP) is a SPIBD subset acquiring a special sense for cipher key pre-distribution.FPP be have parameter ( n ²+ n + 1, n + 1,1) SPIBD.FPP is for any prime power nall exist, wherein n>=2.N rank FPP has four character: (i) each piece just comprises n + 1 point; (ii) each point just appears at non+1 piece; (iii) just exist n ²+ n + 1 point; And (iv) just exist n ²+ n + 1 piece.Amtepe and Yener( combinatorial Design of Key Distribution Mechanisms for Wireless Sensor Networks. In Proc. of Computer Security – ESORICS, Springer-Verlag, LNCS 3193,2004, pp 293-308) SBIBD design is applied to the cipher key pre-distribution in SN.

Suppose FPP have parameter ( n ²+ n + 1, n + 1,1), its element belongs to set s, wherein | s|= n ²+ n+ 1.Use Eschenauer and Gligor( a key-management scheme for distributed sensor networks. In Proc. of the 9 ^thaCM conference on Computer and communications security, pp.41-47,2002) term, sassociated with pool of keys, sin each element associated from different random keys.In addition, each piece of FPP is associated with key ring.The character of FPP has guaranteed that any pair of secret keys ring (piece) has 1 public random key (element).

For nthe sensor network of node (SN), always total nindividual key ring, has n ²+ n + 1>= nthe FPP of individual piece need to gather by use sconstruct.This provides n ²+ n + 1>=N key ring, each key ring has k= n + 1 key and oneindividual public key.The memory capacity size requiring on node therefore for ( n+ 1) * log q(be equivalent to m= n+ 1). cunningassailant need to catch α= k= n + 1 node can damage described SN.

Add up to neach sensor node of SN receive different key rings.Notice specific key of every two nodes sharing.In fact, according to the character of FPP, every n + 1 transducer is shared same specific key.Therefore, the key of this KPS can not be for the unique evaluation of node.Second relevant problem is always may not find such FPP, wherein (i) nit is prime power and (ii) n ²+ n + 1>= n, restrictive condition is m>= n + 1.

Amtepe and Yener solve the problems referred to above by constructing a kind of Mixed Design, this Mixed Design comprise FPP ( n ²+ n + 1, n + 1,1) n ²+ n + 1 piece and

( n ²+ n + 1, n ², n ²- n) n- n ²+ n + 1 choose arbitrarily ( n+ 1) element sub-block, wherein n< m-1(is that the size of key ring is now m>= k> n + 1).Its seondary effect is: (i) k> n + 1; (ii) some specific keys are by incessantly n + 1 nodes sharing; (iii) some nodes are to likely sharing nearly n ²- nindividual node; And (iv) at least n- n ²+ n + 1 piece does not have public key.Therefore, due to (iv), at least n- n ²+ n + 1 can not directly set up public keys, and due to (i), (ii) and (iii), α≤ n + 1< k≤ m, network resilience has reduced.

In recent years, many random key Managed Solutions based on cipher key pre-distribution have been proposed, to protect the communication fabric of extensive DSN.These Managed Solutions are supposed the wide connectedness of DSN based on following hypothesis: sensor node can be wirelessly connected to the adjacent node (for example node in range for wireless communication) of minimum degree, and sensor node has very limited flexibility after disposing.These schemes are intended to pursue the wide secure connectivity of maximum DSN and network resilience, meet the operation constraint of DSN simultaneously.In random key pre-distribution scheme, each node received the random key subset of arrogant pool of keys before disposing.In order to determine for carry out the key of secure communication with certain probability, two neighborss are found a public key and are used this key as its shared private key in its subset.Do not find two sensor nodes of public keys to utilize other in its neighborhood to be subject to trusted node, even several steps of tripping are to help to set up public keys.Based on Blom( an optimal class of symmetric key generation systems. In Proc. of the EUROCRYPT 84 workshop on Advances in crytology:theory and application of cryptographic techniques, pp.335-338,1985) Random Dual cipher key pre-distribution scheme or the scheme of Blundo by increase network resilience and additionally defining node identify to strengthen the former.

But random key pre-distribution scheme is also not suitable for protecting BSN.First, because the degree of neighbors is little, BSN can not allow two arbitrarily node set up directly or indirectly public keys.Secondly, due to the possibility that node is caught, node is identified and must directly be carried out without any interstage.

Because BSN independently does not interconnect, recommend can not be used in BSN for the centralized or distributed overall intruding detection system (IDS) of DSN or AD-HOC network.In BSN, impaired node may can be detected, but traditional system and method can not send to this information all the other nodes in other BSN effectively.Therefore, BSN is easily subject to Node replication attack more than extensive DSN.For example, in hospital, from clever assailant's attack, be the biggest threat for BSN fail safe.Although do not clearly state in the literature, for the node of previous cipher key pre-distribution scheme, to catch with node and copy, network resilience height depends on the existence of the wide effective IDS of DSN.The elasticity of network (iresiliency) is defined as the nodes λ that assailant need to catch to damage a part for total DSN communication.Clever assailant needn't catch and distort λ node and carry out offensive attack.As long as clever assailant catches one or sub-fraction node and carrys out attacking network with impaired key.In fact, in order not to be detected, assailant can not attempt to interrupt network of network operation, but reads as possible or revise confidential information or even inject spoofing.In this way, assailant just can obtain and/or inject desirable information even must not wasting the in the situation that own resource being damaged other network services.

Finally, in some scheme, need the Key Establishing mechanism that helps by neighbours connective to realize the safe DSN of height.The assailant with appropriate keys can obtain help from the adjacent node (by that analogy) of one or more adjacent nodes, these nodes to set up the key with complete neighborhood.If node neighbours' Key Establishing is helped to sacrifice secure connectivity improved fail safe by restriction, assailant still can move and attempt to attack neighbours as much as possible so.Key managing project effective and safety especially must be considered clever assailant in BSN arranges.

Needed is such cipher key pre-distribution scheme, and it allows to identify, confidentiality and integrity service, and network security connectedness, elasticity and extensibility and the optimum execution efficiency of enhancement are provided.Also need such key managing project, it controls the use of preassignment key, is applicable to the operating condition of BSN.What the present invention considered is improved equipment and the method that has overcome aforementioned disadvantages and other defect.

summary of the invention

According to an aspect, for monitoring patient's wireless network, comprise the body sensor networks being formed by one or more wireless sensers, during described one or more wireless senser operation, be connected to patient, collect the information relevant with patient and these information are sent to wireless network.Server is set to be configured described one or more wireless sensers with keying material before described one or more transducers are deployed to wireless network.The one or more transducers associated with body sensor networks are distributed to by key certificate in mobile base station, and wherein two transducers generate unique pairwise key (pairwise key) according to preassignment keying material with by the key certificate of base station assigns at least in part.

According on the other hand, wireless network comprises the network that is comprised of one or more radio nodes and server is set, and the described server that arranges was configured described one or more radio nodes with keying material before described one or more nodes are deployed to wireless network.The one or more transducers with described network associate are distributed to by key certificate in base station, and wherein two nodes generate unique pairwise key according to preassignment keying material with by the key certificate of base station assigns at least in part.

According to another aspect, a kind of method is distributed and is estimated and distribute with combination tpolynomial set share is to maximize extensibility, elasticity and the execution efficiency of wireless system, and it comprises via server is set security key is pre-assigned to the sensor node of communicating by letter on this wireless system uand sensor node v.

According to another aspect, the transducer in a kind of method identification movable sensor system u, it comprise from n-1 mutually orthogonal nthe set of rank Latin square (Latin square) form limited projection plane ( n ²+ n + 1, n + 1,1), wherein nit is a prime power (prime power).According to usensor id, transducer vfast and effeciently find public tpolynomial set share and fast and effeciently derivation tpolynomial set share estimation point.

An advantage of the invention is, it offers large numbers of sensor nodes by security key, thereby makes communicating by letter on battery, the CPU ability node limited with memory capacity, calculating and storage efficiency optimization.

Another advantage is that it provides the security strength strengthening to the preassignment security key that is assigned to large numbers of sensor nodes.

Also having an advantage is that the fail safe providing is transparent for the user of described wireless network.

Another advantage is, the fail safe providing allow to (large numbers of transducers) whatever arbitrarily in pairs sensor node carry out unique identity authentication and allow to set up and sensor wireless neighborhood density or the irrelevant trusting relationship of size,

Another advantage is that described fail safe has alleviated the degree that wireless network may be impaired.

After reading the following detailed description of preferred embodiment, many extra advantages and benefit will be apparent for those of ordinary skills.

Accompanying drawing explanation

The present invention is embodied as different parts and component configuration, and different steps and arrangements of steps.Accompanying drawing, only for graphic extension preferred embodiment, should not be regarded as having limited the present invention.

Fig. 1 illustrates a kind of movable sensor system, this movable sensor system adopt arrange server during pre-deployment phase in a plurality of transducers configuring cipher key data.

Fig. 2 illustrates and utilizes unique pairwise key that the methodology of secure communication is being provided between wireless senser in pairs.

Fig. 3 has also shown how in the movable sensor system of the system such as in Fig. 1, to use sensor id.

Fig. 4 is illustrated in the another set of method such as identification sensor in the movable sensor system of the system in Fig. 1.Fig. 4 has also shown in the movable sensor system of the system such as in Fig. 1 how to use sensor id.

It is public that Fig. 5 illustrates discovery tthe methodology of polynomial set share.

Fig. 6 illustrates derivation tthe methodology of polynomial set share estimation point.

Fig. 7 illustrates a kind of movable sensor system, this movable sensor system adopt arrange server during pre-deployment phase in a plurality of transducers configuring cipher key data.

Fig. 8 illustrates a kind of movable sensor system, and this movable sensor system adopts security server and base station between a plurality of transducers in this movable sensor system during rear deployment phase and corresponding body sensor networks, to carry out safe communication to allow.

Fig. 9 illustrates a kind of cipher key pre-distributing method of the Blom of employing symmetric key pre-distribution scheme.

Figure 10 illustrates a kind of employing for the cipher key pre-distributing method of the Blundo scheme of cipher key pre-distribution.

Figure 11 illustrates a kind of method that confirms preassignment key.

Figure 12 illustrates a kind of method of managing preassignment key.

Figure 13 illustrates a kind of method of managing preassignment key.

Figure 14 illustrates a kind of method of managing preassignment key.

Figure 15 illustrates a kind of method of managing preassignment key.

Embodiment

certainty pairwise key preassignment system (DPKPS) and method

Fig. 1 illustrates a kind of movable sensor system 2, and this movable sensor system 2 comprises server 4, a plurality of wireless senser 6,8,10,12,14,16,18,20 and a plurality of body sensor networks 22,24,26 are set.It is the server that is exclusively used in fail safe that server 4 is set, and it only initiatively participated in safety operation before disposing transducer.Wireless senser 6-20 is connected to for example, by the initial configuration stage before using (in advance dispose) in server 4 is set at transducer 6-20.Server 4 is set and typically resides in physically in shielded scope, only have the office worker who has authorized to access.During deployment phase, wireless senser contacts server is set without any approach.Deployment region typically can be by public access.Wireless senser 6-20 is the node of being responsible for collecting and transmitting patient medical data.Any one in transducer 6-20 all with transducer 6-20 in one or morely set up wireless connections.Sensor node is limited to memory capacity, battery and CPU.Body sensor networks (BSN) 22-26 is the set of Wireless Networking sensor node, and it can be connected to one or more patient's (not shown).Owing to there being a large amount of nodes in system, thereby BSN is limited to bandwidth typically.For example, in hospital environment, may there is for example BSN of a patient of hundreds of or thousands of BSN().

The application requirements log of BSN qthe key of bit.According to an embodiment,

, t>=1.Q is fixed as to desired level of security (for example 64 bits), can calculates fq' on multinomial, and people's such as application Liu etc. multinomial optimization obtains log qthe key of bit. tindividual containing fq' on λ binary polynomial of coefficient joint set be called tpolynomial set

. uthe estimation of some place tpolynomial set

after this be individual tpolynomial set share.

Fig. 2 illustrates methodology 30, this cover method 30 by method to set up 32, the pre-dispositions method 34 of key, tpolynomial set share discover method 36 and key establishing method 38 forms, and described key establishing method 38 is used to set up the unique pairwise key between transducer, as the situation of system 2 above.In 32, server is set and generates tpolynomial set share and Combination Design, it can be used to supply nindividual transducer, wherein nbe the size of interoperable node group, and be individual 1 the integer that is more than or equal to.In 34, server is set will according to combination distribution tpolynomial set share is distributed to each transducer.Once dispose complete, in 36, two transducers arbitrarily uwith vfind out them which owns together tpolynomial set share.In 38, described two transducers arbitrarily uwith vpublic by estimating it tpolynomial set share generates unique pairwise key .

An aspect of the present embodiment increased based on tthe extensibility of the KPS of polynomial set and do not reduce its elasticity has kept optimum node execution efficiency simultaneously.In a kind of approach, along FPP-( n ²+ n + 1, n + 1,1) (pass through each tpolynomial set 's n'/( n+ 1) individual different share and the piece that belongs to FPP b _i , i= n ²+ neach element of+1 b _{i, j} , j=1 n + 1 association) will n+ 1 tpolynomial set is distributed to each node u.Due to the character of FPP, with separately according to different masses b _i , b _j ∈ FPP, i≠ jelement distribute n + 1 ttwo of polynomial set share nodes arbitrarily uwith v, share a tpolynomial set

, they can use this tpolynomial set calculates log qunique pairwise key of bit.Similarly, with separately according to same block b _i the element of ∈ FPP distributes n + 1 ttwo nodes sharing of polynomial set share n+ 1 tpolynomial set share.In this way, these nodes can be used n+ 1 tany in polynomial set share calculated log qunique pairwise key of bit.

This technology allow to increase the people such as Blundo and amtepe and Yener KPS extensibility and do not lose any network resilience, keep optimum calculated performance and the possibility of sharing unique pairwise key simultaneously.In addition, this approach solved amtepe and Yener KPS FPP Existence problems and do not reduce network resilience or directly trust connective.

In 32, server is set and generates randomly fq' on t* ( n ²+ n+ 1) individual λ binary polynomial

set.Subsequently, for j=1 n ²+ n + 1, sequence server is set and selects tindividual multinomial and formation n ²+ n + 1 tpolynomial set

.Then, it generate FPP-( n ²+ n + 1, n + 1,1), its element belongs to set s, wherein | s|= n ²+ n+ 1.Set sassociated with multinomial pond, sin each element jfrom different tpolynomial set associated.In addition, each piece of FPP is associated with polynomial ring.The character of FPP has guaranteed that any a pair of polynomial ring (piece of FPP) owns one together tpolynomial set

(element k).

In 34, each sensor node ufrom being set, server receives n + 1 tpolynomial set share

, wherein p _{u, j} ∈ fq', b _{i, j} ∈ b _i ∈ FPP and j=1 n+ 1.Point p _{u, j} must take from finite field fq'.This will p _{u, j} be restricted to qa '-1 different probable value.But, the number of sensors that supply nmay be greater than q'-1.In order to guarantee the uniqueness of pairwise key, two different transducers uwith vcan not have in same point p _k that estimates is same tpolynomial set

.Due to each tpolynomial set f _j ( x, y), j=1 n ²+ n + 1, can be n'= qa '-1 different point estimates, and f _j ( x, y) label jappear at nin+1 FPP piece, thereby ( jappearance place) each in these pieces should be used to by f _j ( x, y) different shares be pre-assigned to and be no more than n'/( n+ 1) individual different transducer.Supply n≤ n' n(1-1/ ( n+ 1))+ n' the cipher key pre-distribution process of individual node adopted following step:

From with element b _1,1, b _{1, n+ 1} first of FPP b ₁start, first node ( u ₁) be received in fq' point p ₁place's estimation tpolynomial set share

arrive

; The second transducer ( u ₂) be received in a little p ₂place's estimation arrive

, by that analogy; Until the n'/( n+ 1) individual transducer ( u _{n'/( n+ 1)} ) be received in a little p _{n'/( n+ 1)} place's estimation

arrive ,

2. next process with element b _2,1, b _{2, n+ 1} second of FPP b ₂, suppose b _1,1= b _2,1, transducer is received in a little p _{1+ n'/( n+ 1)} place's estimation

(for transducer u ₁... u _{n'/( n+ 1)} , compared with low spot, estimating

), and point p ₁place's estimation

arrive ; By that analogy, and

3. use all repeating steps 1 and 2 of FPP so that supply system nindividual node.

In 36, find tpolynomial set share.After deployment completes, before setting up pairwise key, each sensor node umust find it and it partner node vwhich is shared tpolynomial set.For this reason, node uwith vexchange its ID, described ID Latent Including they carry n + 1 tthe label of polynomial set share and point

,

, at these some places, estimate separately n+ 1 tpolynomial set share.Finally, they find label k(corresponding public tpolynomial set f _k ( x, y)) and the point of estimation separately p _u with p _v .

In 38, set up key.In order to calculate pairwise key k _uv , node upoint p _v described in place's estimation tindividual (being included in f _k ( p _u, y) in) λ binary polynomial

, i=1 t(

) to obtain tindividual part key.Then, node udescribed in inciting somebody to action tindividual part key blocks into log q 'bit and connect this tindividual key segment is to form final log qthe pairwise key of bit k _uv .

simple sensor ID

Fig. 3 illustrates the transducer in a kind of DPKPS of identification umethod 50.In 52, it carries n + 1 tpolynomial set share n+ 1 label b _{i, 1} , b _{i, n+ 1} with n + 1 point

connect, described in tpolynomial set share is estimated at these some places.In 54, the unique transducer that identifies of such ID u, and in 56, it allows to find very simply public tpolynomial set share and tpolynomial set share estimation point.

In 58, by finding public with simple sensor ID tpolynomial set share.Two transducers uwith vfind out total which label, for example label in ID separately k.In 60, by obtaining, be included in simple sensor ID kindividual point is derived tpolynomial set share estimation point.

optimized sensor ID

Owing to working as nduring increase, use simple sensor ID to increase significantly storage and the communications cost of DPKPS, so can be by utilizing the character of the FPP based on mutually orthogonal Latin square (MOLS) to adopt a kind of interchangeable optimization sensor ID method.For reality nvalue, this optimal method constructs the very short sensor ID of length.

Fig. 4 has shown and has been used for the methodology 70 of in the movable sensor system of the system 2 such as above identification sensor.

FPP ( n ²+ n + 1, n + 1,1) by n-1 nthe mutually orthogonal Latin squares in rank (MOLS) form.Latin square is n* nsquare formation l, its project (entry) by nindividual symbol forms, and each symbol is just occurred once at every row and every row.These symbols as from 1 to ninteger.Structure la kind of very simple mode be by integer 1,2, naccording to its natural order, be placed in the first row, and for continuous row, to the right periodic cycle previous row.

In 72, form mutually orthogonal Latin square (MOLS). n individual symbol 1,2, non two Latin squares

with

if, during stack n ²to symbol

in every a pair of just appearance once, these two Latin squares are quadratures so.There is phase same order nlatin square set l ¹, l ², l ^t be called MOLS collection, each in described Latin square set is each the quadrature secondary (orthogonal mate) in all the other Latin squares. n-1 nthe set of rank MOLS is a complete set.

Given pair of orthogonal Latin square

with

, the unit in the first square formation (cell) comprises a specific symbol l ¹.Due to the character of Latin square, in each row and column, only there is in these unit.According to orthogonality, in the unit of the quadrature pair corresponding with unit in the first square formation nindividual project forms the transversal (transversal) in quadrature pair, for example this nindividual project just in time comprises each symbol, and one in these unit is positioned at different row and columns with each.

For nfor the situation of prime power, shape as f _a ( x, y)= ax+ y, a≠ 0 ∈ f _n polynomial set representative n-1 nthe complete set of rank MOLS.This causes very simple building method: order e ₁, e ₂, e _n for f _n (be integer 1 n) element.Then, for each element e _m , m=1,2, n, by following formula sequentiallycompute matrix

element

:

（1）

Parameter nwith e _m be enough to construct specific orthogonal Latin square

.

In 74, according to MOLS, construct limited projection plane (FPP).Order l ¹, l ², l ^n-1 for nthe complete set of rank MOLS, and mfor n* nmatrix.First, from the first row to the nrow is by placing by its natural order n ²individual integer 1 n ²carry out structural matrix m.Secondly, according to described MOLS, generate as follows nrank affine plane AG (2, n): (i) before nindividual piece is mrow; (ii) inferior nindividual piece is mrow; And (iii) pass through each order is added to mupper and will with each

in single symbol

corresponding melement regard piece as and form remaining n ²- nindividual piece.Due to each

comprise nindividual different symbol, each

stack produces nindividual piece.Finally, for obtain FPP ( n ²+ n + 1, n + 1,1), (i) by new integer n ²+ 1 add to described affine plane before nindividual piece, (ii) by new integer n ²+ 2 add to described time nindividual piece, (iii) by integer n ²+ 2+ e _m add to from each structure nindividual piece, and (iv) new piece is added in this design, it comprises n + 1 new integer adding.

Given nwith i, easily reconstruct piece b _i ∈ FPP, 1 < i≤2 n.For example, for n=3, by m ^{3 * 3}first row and integer 11 building blocks b ₄, b ₄=(Isosorbide-5-Nitrae, 7,11).For piece b _i ∈ FPP, 2 n< i≤ n ²+ n, label ialso imply and identified Latin square

label e _m , 1≤ e _m ≤ n-1, generate accordingly b _i .For example, for n=3, from l ²generate piece b ₁₂.For these pieces of reconstruct b _i (2 n< i≤ n ²+ n) in one, additionally need element

.

In 76, identify and connected three numbers i, i _p with

transducer u, wherein 1≤ i≤ n ²+ n + 1,1≤ i _p ≤ n'/( n+ 1) and 1≤ e _m ≤ n.The first number iidentify piece b _i ∈ FPP, selects accordingly u's tpolynomial set share, the second number identifies b _i in tpolynomial set share is distributed to uorder i _p , and the 3rd number identifies Latin square l _i element, derive accordingly b _i .This ID identifies uniquely transducer u and allows and finds much more effectively public than simple ID tpolynomial set share and tpolynomial set share estimation point.

In 78, for optimization sensor ID is found tpolynomial set share.In 80, for optimization sensor ID derives tmultinomial share estimation point.

Fig. 5 has shown that the information being included in optimization sensor ID by use finds public tthe method 100 of polynomial set share.In 102, optimization sensor ID allows sensor node ucalculate itself and partner node v's tthe label of polynomial set share.In 104, by more this information, node ucan derive and node vpublic tpolynomial set share f _k ( p _u , y) label k, 1≤ k≤ n ²+ n + 1.

Transducer ucarry tpolynomial set share

label with b _i the element of ∈ FPP b _{i, 1} , b _{i, 2} , b _{i, n+ 1} become one to one to shine upon.As noted above, given n, b _i label iand integer , may reconstruct uniquely so b _{i, 1} , b _{i, 2} , b _{i, n+ 1} }= b _i .Here, must district in two kinds of situation: in 106, piece b _i , 1≤ i≤ 2 nwith

, its reconstruct is easy.Alternatively, in 108, piece b _i , 2 n< i≤ n ²+ n, its reconstruct is also simple, but requires to carry out analysis below.In 108, according to structure affine plane step (iii) (in the step 54 from Fig. 3 a) known, b _i element b _{i, 1} , b _{i, 2} , b _{i, n+ 1} take from min by 2 nindividual coordinate ( i ₁, j ₁), ( i ₂, j ₂) ... ( i _n, j _n) position of mark, wherein

appear at

in.Like this, determine these coordinate times, obtain b _i element.In 110, according to label idirectly derive e _m , it identifies for choosing b _i element in nindividual Latin square

.In 112, element

determining positions in transversal, thereby

every row in occur once.Like this,

appear at position (1, j ₁), (2, j ₂) ... (n, j _n) locate.Suppose

with e _m known, utilize equation 1, can obtain:

……

In 114, solve these equations, this generation has nindividual different value

vector V.As already noted, from F _nelement e ₁, e ₂, e _n in order for compute matrix

each element , i.e. element e ₁for calculating location (1,1), (2,1), (3,1) ... ( n, 1) } element located, element e ₂for calculating location (1,2), (2,2), (3,2) ... ( n, 2) } element located, by that analogy.In other words, each value

determine

the coordinate of appearance place (1, j ₁), (2, j ₂) ... ( n, j _n ), for example, if for i ₃=3,

, so j ₃=2(

appear at (1, j ₁), (2, j ₂), (3,2) ... ( n, j _n ) locate).

Finally, in 116, these coordinates are mapped to matrix melement, like this from b _i 's nin+1 element, directly determine nindividual element.Now, obtain the piece of affine plane.By integer n ²+ 2+ e _m add this piece to, obtain piece b _{i, 1} , b _{i, 2} , b _{i, n+ 1} }= b _i .Generate in this way piece (at the most) needs of FPP f _n in nsub-addition and ninferior multiplication.

Fig. 6 illustrates derivation tthe method 130 of polynomial set share estimation point.In order to derive a little p _v , node umust follow the simple procedure that the character of FPP allows, at described point p _v place's node uestimate its share f _k ( p _u , y) to generate key k _uv .

It is as noted above, i _p it is node vaccording to piece b _i ∈ FPP, 1≤ i≤ n ²+ n + 1, torder in the distribution of polynomial set share.Will suppose tpolynomial set f _k ( x, y) share distribute to v.Process described below allows to derive point p _v ∈ fq', in this some place estimation vshare f _k ( p _v , y).Suppose

, wherein s _k quantize f _k ( x, y) at piece b _j ∈ FPP, j=1 ithe number of middle appearance.

In 132, because FPP constructs from MOLS, it starts n ²individual element is at every group nindividual follow-up piece b _{1+ t} , b _{2+ t} , b _{n+ t} , t=0, n, 2 n, 3 n... n* nmiddle appearance once.Then, in 134, given label i, 1≤ i≤ n ²+ n,and tpolynomial set label k, k≤ n ², easily derive it counter occur s _k ,

.Shape as k= n ²+ j, j=1 neach element of+1 is at described b _{i+ n( j-1)} , i=1 ngroup in occur ninferior.In this case, s _k =i-n (j-1).In 136, piece

element k= n ²+ j, j=1 n + 1 nappear in FPP for+1 time.Therefore, given tpolynomial set label k, piece label irank with FPP n, node ucan directly derive a little p _v -to estimate it and node vpublic share f _k ( p _u , y).

Be different from random key method for pre-distributing formerly, these embodiment allow two random sensor nodes of selecting directly to find public keys to independently identify with (or neighborhood) in DSN term size and the density of BSN.Additionally, safe communication still be identified and/or be set up to sensor node can and at different BSN internetwork roamings.The fail safe of BSN is not in the situation that need BSN user of service's active or participate in consciously setting up.

operation key management

Fig. 7 and 8 illustrates a kind of system 150, and it comprises security server 152, server 154 is set, a plurality of wireless senser 156,158,160,162,164,166,168,170, a plurality of body sensor networks 172,174,176 and mobile base station 178 and 180.Fig. 7 has shown the system 150 before transducer 156-170 is deployed.Fig. 8 has shown the system 150 after described transducer has been deployed.In an example, security server 152 and/or server 154 is set is the private server for fail safe.Security server 152 is the servers that are exclusively used in fail safe, and it all initiatively participates in safety operation before and after disposing transducer.It is the server that is exclusively used in fail safe that server 154 is set, and it only initiatively participated in safety operation before disposing transducer.After having disposed transducer 156-170 and base station 178,180, its continuation or be exclusively connected to once in a while base station.As shown in Figure 8, once dispose completely, transducer 156-170 is also free of attachment to security server 152.As shown in Figure 7, mobile base station 178,180 and transducer 156-170 only in pre-deployment phase (these equipment by the initial configuration before using in) just can be connected to server 154 is set.

Wireless senser 156-170 is responsible for collecting and transmitting patient medical data.In an example, transducer 156 can be established to second any sensor 158 and/or 180 the wireless connections to base station.Sensor node is limited to memory capacity, battery and CPU.In Yi Ge hospital, may there are thousands of transducers.One or more BSN are set of Wireless Networking sensor node.The node of BSN can be connected to one or more patients.BSN is typically subject to the restriction of bandwidth.In Yi Ge hospital, may there is for example BSN of a patient of hundreds of or thousands of BSN().Mobile base station (BS) 178,180th, by the data and the mobile device that configures BSN that visit on BSN.BS is medium resource and power apparatus typically.In Yi Ge hospital, may there are hundreds of or thousands of BS.

Operation key management solution is comprised of following methods:

1. cipher key pre-distribution.Setting/security server is distributed to each transducer according to basic cipher key pre-distribution scheme by basic keying material, and distributes to each mobile base station by different approach.This is to complete in the configuration phase before transducer or base station are deployed in hospital for example.

2. preassignment key authentication.One arbitrarily BS access some formation arbitrarily the transducer of BSN so that distributing key certificate kC _l , it makes in previous step preallocated keying material at given following interval i _l effectively interior.

3. key Establishing.Two transducers arbitrarily uwith vby generating unique pairwise key with preallocated keying material and effective key certificate k _uv .

basic cipher key pre-distribution scheme

Can adopt different complete methods to realize symmetric key pre-distribution scheme (scheme or the DPKPS of people such as Blom, Blundo), described symmetric key pre-distribution scheme can be used as the basic framework of following proposal.

Fig. 9 shows a kind of cipher key pre-distributing method 230 that has adopted the symmetric key pre-distribution scheme of Blom.Blom scheme allows any a pair of node in network to derive pairwise key.Work based on people such as Du ( a pairwise key pre-distribution scheme for wireless sensor networks. In Proc. of the 10th ACM Conference on Computer and Communications Security (CCS), 2003, pp.42-51), according to the present embodiment, added slight modifications for Blom original scheme to make it be applicable to BSN.

Can use as follows the scheme of Blom.During pre-deployment phase, in 232, server is set in finite field fqupper structure (λ+1) * nmatrix g, wherein nfor the size of the interoperable node group that may run in different B SN, qit is a large numeral that must be enough to supply encryption key. gbe counted as public information, comprise that any transducer of potential illegal user can be known gcontent.In 234, server is set and exists fq(λ+1) of upper establishment random secret * (λ+1) symmetrical matrix d, and in 236, calculate n* (λ+1) matrix a=( dG) ^t , wherein ( dG) ^t for dGtranspose of a matrix.Due to dsymmetrical, so k= aGit is a symmetrical matrix.Therefore, k _uv = k _vu , wherein k _uv to be positioned at kin urow and the vthe element of row. k _uv (or k _vu ) as node uand node vbetween pairwise key.Finally, for k=1,2, n, server-assignment is set:

1. in 238, matrix a krow is to node k, and

2. in 240, matrix g krow are to node k.Alternatively, in order to save the needs to memory capacity, can be by generator matrix g kthe seed of row g( k) distribute to node k.

In 242, determine whether seed is assigned with.If no, after deployment phase, in 242, work as node so uwith vin the time of need to finding out pairwise key between them, first they exchange theirs gin row.Alternatively, in 244, if distributed seed, so node uwith vexchange seed and calculate other nodes grow.Then, in 246, node uwith vby using theirs ain privately owned row can calculate respectively k _uv with k _vu .Because gpublic information, so can be with expressly sending its row (or seed).

Alternatively, as shown in figure 10, method 250 utilizes Blundo scheme to carry out cipher key pre-distribution.The people such as Blundo propose based on polynomial Key Distribution Protocol to derive group key.For two users' group, the scheme of Blundo is the special case of the scheme of Blom, has advantages of outstanding: in pairwise key process of establishing, there is no communication overhead.Discuss below and in BSN context, set up the special circumstances based on polynomial pairwise key.

In 252, server is set in finite field fqthe upper random binary λ order polynomial that generates

, make it there is character f( x, y)= f( y, x), wherein qit is a large prime number that must be enough to supply encryption key.Suppose that each transducer has unique identifier (ID).In 254, it is each transducer that server is set ucalculate

multinomial share (

) and distributed to each transducer u.

In 256, for any two sensor nodes uwith v, node ucan be by estimation point vplace f( u, y) calculate public keys k _uv = f( u, v), and node vcan be by estimation point uplace f( v, y) calculate same key k _vu = f( v, u)= f( u, v).Security Proof in the people's such as Blundo document has guaranteed that this scheme is that unconditional security and anti-λ gang up.In other words, be no more than ganging up and not knowing the pairwise key between any two not impaired nodes of λ impaired sensor node.

As preferred alternate item, DPKPS can be used for to initial preassignment pairwise key to transducer.

Active method is used to promote to the trust of key and controls the use to key, thereby reduces the impact of impaired node, and described key carries out preassignment by any basic cipher key pre-distribution scheme.

Should suppose, the life-span of all the sensors node is all divided into nthe public long interval that+1 duration is T, is designated as i ₀, i ₁, i ₂, i _n , sensor node all with the overall situation reference time loose synchronization, even when these transducers connect in different BSN, situation is also like this.

Figure 11 illustrates for authenticating the methodology 260 of preassignment key, and is the summary of the cipher key authentication method in Figure 12-15 below.In 262, in each time interval i _l-1 during this time, (where tube sensor is not positioned at) mobile base station (BS) all contacts transducer once in a while, in 264, after the integrality of test sensors, in 266, by key certificate kC _l distribute to each int sensor node.In 268, key certificate kC _l make the integrality of transducer preassignment key at single interval i _l effectively interior, preassignment key is in the time interval i _l effectively interior.Similarly, in 270, impaired node udo not receive key certificate kC _l , thereby its preassignment key is cancelled.

Hereinafter, provide serial of methods 280,310,330 and 370; Each scheme after leaning on is to improve forward scheme by solving some deficiency of forward scheme.Method 280,310, the difference between 330 and 370 be in base station and base station and security server between connective rank.How these methods generate or reach aspect key certificate is also distinguishing.

Figure 12 shows for concentrating the methodology 280 of issue global secret certificate.In this part, security server resides in and is different from the home that BSN disposes district.As noted above, security server is the server that is exclusively used in fail safe, and it all initiatively participates in safety operation before and after disposing transducer.It is the server that is exclusively used in fail safe that server is set, and it only initiatively participated in safety operation before disposing transducer.Therefore, server is set and after transducer has been deployed, keeps off-line state.Supposition in addition, one or more mobile base stations are present in BSN once in a while and momently.Base station also contacts with security server once in a while.Because base station is expensive node, they have adopted tamper resistant hardware and not restriction aspect computing capability or memory capacity.Like this, the quantity of mobile base station is much smaller than the quantity of sensor node.Because base station is not typically unattended and they are only present in BSN deployment region once in a while, thus they and be not easy to be caught or damage.

Because sensor node is movably, therefore can not suppose base station always in the wireless range of BSN (patient who has for example connected some transducers with it takes a walk through hospital garden).But since the object of BSN is to collect the data be sent to terminal use, thereby supposition BSN is by the wireless range in base station once in a while.This is the important requirement to BSN, otherwise because the restriction of memory capacity in sensor node may cause the loss of the information that sensor node is collected.The shortcoming that static private server is used for to sensor network security is well-known.For example, lawless person may attempt private server to initiate denial of service (DoS) attack.If private server is through copying, movably and being not always present in BSN, these shortcomings have not just existed so.In BSN environment, suppose and have mobile base station.For example, doctor downloads the data from patient BSN in garden by a kind of approach.Hereinafter, term base station refers to mobile base station, and it can be for fail safe object.

In 282, before deployment according to any in described basic cipher key pre-distribution scheme (scheme of people such as Blom, Blundo, DPKPS), with unique identifier and fail safe data initialization sensor node.Do not adopt basic cipher key pre-distribution scheme that the pairwise key between sensor node and base station is provided, to avoid occurring the risk that may pretend to be base station of ganging up of λ impaired node.In addition do not advise in base station, bSiand shared group key between sensor node, because the impaired of individual node can damage the fail safe of all the other nodes, thereby make base station bSibe not useable for safety operation.On the contrary, in 284, for each base station bSi=1 ..., mwith each sensor node u=1 ..., n, n>> m, security server is according to usual cipher key pre-distribution scheme random choose and distribute pairwise key k _{u, bSi} .This scheme allows each sensor node and base station bSicommunication safely.It is unconditional security, and in node, required additional storage capacity is only m* log q.Finally, in 286, security server is by random choose ciphertext k _n and generation k _k = f( k _{k+ 1} ), k=0,1 ..., n-1 produces and has n+ 1 element k ₀, k ₁..., k _n key chain, wherein fit is a pseudo-random function.In 288, security server is by the initial element of this key chain k ₀distribute to each sensor node u=1 ..., n.Utilize pseudo-random function f, in given described key chain k _k , any sensor node can calculate key formerly k _m ; 0≤ m≤ k, but can not calculate after key k _m ; k+ 1≤ m≤ n.Therefore, utilize initial key k ₀knowledge, sensor node only just can be identified any key in described key chain by carrying out pseudo-random function computing.Second element in described key chain k ₁originally be assigned to each base station bSi.

Base station has the effect of the Entrusted authentication mandate that is similar to public-key cryptography fabric, and security server is as trusted root.In 290, base station is distributed to not impaired node by key certificate (KC), and this key certificate makes its preassignment key in finite time section teffectively interior.Time period tlater, the preassignment key of node is no longer valid.The element of described key chain k ₀, k ₁..., k _n in order as corresponding each time interval i ₁, i ₂..., i _n key certificate.Hereinafter, the element of described key chain is called key certificate kC ₀, kC ₁..., kC _n .

In 292, in the time interval i _l during this time, each base station bSito contact with security server once in a while.Because base station and security server are powerful nodes, they can protect its communication by public key encryption art.Security server will be next key certificate kC _{l+ 1} give each base station bSi, bSi=1 ..., m.It should be noted that if there is the impaired such rare events in base station to only have a certificate to suffer damage, disclosing of the further key certificate of entail dangers to not, next key certificate can not be calculated in impaired base station itself.Due in the next time interval i _{l+ 1} interior base station can not contact with security server, thereby the impaired of base station easily detected.Therefore,, in the follow-up interval at impaired interval, impaired base station will can not obtain key certificate.But, in this case, impaired base station should be noticed to all the sensors node in all the other base stations bSisign.Each sensor node uto wipe it with bSishared key k _{u, bSi} thereby, will bSifrom being trusted station list of it, delete.

In 294, in the time interval i _l during this time, at least one base station arbitrarily bSito contact with BSN once in a while and momently.In 296, by using suitable key k _{u, bSi} , base station bSito identify and set up and form each not secure communication of impaired sensor node of a BSN part.In 298, base station will with the time interval i _{l+ 1} corresponding key certificate kC _{l+ 1} distribute to the sensor node that each has been identified.The 3rd, sensor node will be checked h( k _{l+ 1} ) equal to have stored k _l .In disadvantageous situation, sensor node can be inferred base station reliably bSiimpaired, thus the key certificate that refusal is forged kC' _{l+ 1} .

In 300, set up key.If two nodes need to be set up pairwise key, they derive pairwise key first as explained above.Then, they check and both have from base station bSieffective key certificate.By two sensor nodes uwith vthe key certificate proof procedure of carrying out must be safe, to prevent that illegal user from obtaining effective key certificate.Therefore, this process can not require by internal check separately key certificate be for current time interval iland issue and check that these key certificates can be by the initial key of described key chain k0identify (or the auth key of deriving km; m<l), first exchange key certificate separately, then verify these key certificates.On the contrary, two sensor nodes all move zero knowledge (ZK) agreement proves both have effective certificate, and does not need to disclose practically this certificate.ZK agreement provides as follows:

。

In (1), node uby current (nonce) of self-generating nusend to node v.In (2), node vcurrent by self-generating nvsend to node u.In (3), uuse key certificate kCland two current nuwith nvcalculate message authentication code (MAC:message authentication code).Two must be included in message (3) and (4) now to avoid reflection attack, vdo not knowing kClsituation under cheat ucalculate kZNP, then vcan use this kZNPcome and the 3rd node wsuccessfully move ZK agreement.Utilize similar program, in (4) vcalculate same ZK protocol cipher kZNPvu.It should be noted that kZNPuv ≠ KZNPvu.Two ZK protocol ciphers must be different, to avoid vdo not knowing kClsituation under just replay message (7) to successfully move ZK agreement.In (5), uuse pairwise key kuvcalculate kZNPuvmAC.In (6), vuse pairwise key kvucalculate kZNPvumAC.These two steps are absolutely necessary, so that will kClknowledge respectively with uwith vassociate.They also prevent that assailant from eavesdropping the message of exchange in (7) and (8).Finally, uchecking vknow kCl: according to vthe step of carrying out in (4) and (7), ucan calculate a segment information come with in (8) from vthe information receiving compares.Node vcan verify according to similar program u's kClknowledge.It should be noted that because the message of (7) and (8) exchange is to use respectively by node uwith vthe MAC that the information of storage inside is calculated, and further information is not disclosed, therefore relevant kClinformation do not have disclosed.

Figure 13 shows the methodology 310 of the consistent global secret certificate in the center of being used to provide.There is serious defect for some application in the method from Figure 12: in these application, requires base station bSiit may be infeasible contacting with security server.But in many application, base station will have mutual accidental interconnection in upper a period of time before once accessing BSN.For example, the information of collecting in different B SN is carried out to overall situation exchange.In method 310, utilized this fact.

In method 310, suppose that off-line arranges server and resides in the home that is different from BSN deployment district.Also supposition appears at a large amount of mobile base stations in BSN once in a while and momently bSi, bSi=1 ..., mexistence.But in method 310, these base stations deployment phase later not with server be set carry out accidental contacting.On the contrary, they interconnect once in a while and momently each other.Other supposition for base station of discussing in method 280 are also set up in method 310.

In 312, before disposing, according to any one scheme in described basic cipher key pre-distribution scheme, by unique identifier and fail safe data, sensor node is carried out to initialization.In 314, for each base station bSi=1 ..., mwith each sensor node u=1 ..., n, n>> m, security server is selected randomly according to usual cipher key pre-distribution scheme and is distributed pairwise key k _{u, bSi} .

Base station has the effect of the interconnection Certificate Authority that is similar to public-key cryptography fabric.In 316, base station is to not impaired node issue key certificate, and this key certificate makes its preassignment key in the limited time period teffectively interior.Time period tlater, the preassignment key of node is no longer valid.In 318, in the time interval i _l-1 during this time, each base station interconnection each other once in a while.Because base station is powerful node, so they can protect by public key encryption art their communication.In 320, the corresponding time interval is put up with in base station i _{l+ 1} key certificate kC _{l+ 1} reach an agreement.

In the time interval i _l during this time, at least one base station arbitrarily bSito contact with BSN once in a while and momently.In 322, base station bSisuitable key will be passed through to use k _uBSi identify and set up and each the not secure communication of impaired sensor node that forms a BSN part.In 324, base station will with the time interval i _{l+ 1} corresponding key certificate kC _{l+ 1} distribute to each and identified sensor node.

The time interval i _l later, each base station bSiignore key certificate kC _{l+ 1} .Therefore, base station bSiat the most two time intervals i _l-1 with i _l keep key certificate kC _{l+ 1} .It should be noted that under the impaired rare cases in base station to only have two key certificates kC _l with kC _{l+ 1} suffer damage, disclosing of the further key certificate of entail dangers to not, impaired base station can not be predicted kC _{l+ 1} next key certificate.Due in the next time interval i _{l+ 1} interior base station can not contact with security server, thereby the impaired of base station easily detected.But, in this case, impaired base station should be noticed to all the sensors node in all the other base stations bSisign, and if if possible, distribute corresponding current time interval now i _{l+ 1} the key certificate of renewal kC ^renewed _{l+ 1} .Each sensor node uto wipe it with bSishared key k _{u, bSi} thereby, will bSifrom being trusted station list of it, delete.

In 326, set up key.If two nodes need to be set up pairwise key, they derive pairwise key first as explained above.Then, they check both have effective key certificate as the operation ZK agreement of passing through of being explained in method 280.

Figure 14 shows the methodology 330 that allows global secret certificate part to reach an agreement.For some application, method 300 has serious defect: in these application, require all base stations bSiin the time interval i _l interconnection may be infeasible each other during this time.Also had base station Jiang Cheng group ground interconnection once in a while undoubtedly in upper a period of time before once accessing BSN.For example, the information of collecting in different B SN is exchanged.In method 330, utilized this fact.

In 332, before disposing, according to any one scheme in described basic cipher key pre-distribution scheme, by unique identifier and fail safe data, sensor node is carried out to initialization.In 334, for each base station bSi=1 ..., mwith each sensor node u=1 ..., n, n>> m, server is set and according to usual cipher key pre-distribution scheme, selects randomly and distribute pairwise key k _{u, bSi} .In 336, security server generating ciphertext s.In 338, arrange server according to ( t, m) threshold scheme ( t≤ m) from ciphertext smiddle generation mindividual share s ₁, s ₂..., s _m , and will s _i distribute to safely each base station bSi.Any its share collected tindividual or more base station can restore easily s, but anyly only know tthe group of base stations of-1 or share still less can not.It should be noted that t=1 in particular cases, each base station bSihold actual ciphertext s.

According to this specific approach, base station has the effect of the interconnection Certificate Authority that is similar to public-key cryptography fabric.In 340, base station is to not impaired node issue key certificate, and this key certificate makes its preassignment key in the limited time period teffectively interior.Time period tlater, the preassignment key of node is no longer valid.

In 342, in the time interval i _l-1 in, each base station bSito carry out once in a while safe interconnection, form little non-interconnected set g _g , g ₁, g ₂... g< m.Each base station bSibe connected at least one group g _g .Therefore, the member's of each group quantity is

, wherein

for being less than or equal to xlargest natural number y.Group g _g can be expressed as g _g = g _gl ..., g _gk ; k=| g _g |.For example, m=7 base stations and g=3 o'clock, so | g _g |>=2 and group layout may be g ₁ = bS2, bS3, bS6and g ₂ = bS1, bS4, bS5and g ₃ = bS1, bS7.It should be noted that for group g ₃ , | g ₃ |=2 and g _g1 = bS1and g _g2 = bS7.A necessary condition of drawing is now, for all g, | g _g |>= t.In 344, group g _g member g _gl ..., g _gk collect its share s _gg1 s _ggk calculate s.Then, each group membership is by solving kC _{l+ 1} =F( s,l+ 1) independently calculate corresponding interval i _{l+ 1} key certificate kC _{l+ 1} .Finally, each group membership ignores s.

In the time interval i _l during this time, at least one base station arbitrarily bSito contact with BSN once in a while and momently.In 346, base station bSisuitable key will be passed through to use k _{u, bSi} identify and set up and each the not secure communication of impaired sensor node that forms a BSN part.In 348, base station will with the time interval i _{l+ 1} corresponding key certificate kC _{l+ 1} distribute to each and identified sensor node.With the same in method 300, in the time interval i _l later, each base station bSiall ignore key certificate kC _{l+ 1} .

In 350, set up key.If two nodes need to be set up pairwise key, they are first as the derivation pairwise key of being explained in method 300.Then, they check both have effective key certificate as the operation ZK agreement of passing through of being explained in method 270.

Figure 15 shows the methodology 370 that allows different key certificates to reach locally consistent.Method 330 has significant operational progress with respect to method 270 and 300: every sub-fraction of base station is managing keys certificate independently, and needn't with server contact is set.And under the impaired rare cases in base station, the fail safe of all BSN can not suffer damage in interval in remaining time.

The important advantage of scheme is formerly: in the time interval i _l during this time, all the sensors node can both independently identify and/or set up safe communicating by letter with its mobility, in the time interval i _l during this time, sensor node can be roamed through different BSN, and still can among they all, carry out safe communication.In other words, method 270,300 and 330 allows the node in different B SN to carry out logical security interconnection through single security domain.This brings the effect colliding to fail safe conversely: undetected impaired node is at impaired interval i _l remaining time in still can be connected to BSN because it is held kC _l and if it is held kC _{l+ 1} , so at next interval i _{l+ 1} inside also may be like this.Should be understood that, impaired node can not rogue base station.Like this, impaired node obtains k _{l+ 1} sole mode be to receive it before impaired.

But, in some sensor application, the fragility of system is so not serious.Consider that transducer wherein has the application of low-down mobility herein.Imagine, for example one group of transducer is connected to human body.Naturally in its situation, human body is movably, but the transducer connecting does not relatively move each other.

In method 370, BSN is not by all sharing same key certificate kC _l come logically to interconnect safely.On the contrary, in this embodiment, different BSN can have different key certificates kC ¹ _l , KC ² _l kC ^m _l , the sensor node that belongs to certain BSN is had to different key certificates from belonging to kC ⁱ _l with kC ^j _l , i ≠ jbSN all the other nodes separately.In other words, all transducers belong to different and dynamic security domain now, and each security domain is determined by the key certificate of one group of base station agreement without demur.In the given time interval i _l in, and if only if could communicate by letter safely while belonging to same security domain for two sensor nodes.

In 372, the preassignment key described in method 330.In 374, preassignment key certificate.Base station has the effect of the root Certificate Authority that is similar to public-key cryptography fabric.In 376, base station is to not impaired node issue key certificate, and this key certificate makes its preassignment key in the limited time period teffectively interior.Time period tlater, the preassignment key of node is no longer valid.From different base station bSiwith bSj, i ≠ jkey certificate kC ^bSi _l with kC ^bSj _l may be also unequal.

In 378, in the time interval i _l-1 in, each base station bSito carry out once in a while safe interconnection, form little non-interconnected set g _g , g ₁, g ₂... g< m.Each base station bSibe connected at least one group g _g .In 380, group g _g member g _gl ..., g _gk collect its share s _gg1 ... s _ggk calculate s.In 382, each group membership is by solving kC ^g _{l+ 1} = f( s, n _ggl ) come independently to calculate corresponding interval i _{l+ 1} key certificate kC ^g _{l+ 1} , wherein n _ggl it is corresponding interval i _{l+ 1} be specific to group g _g current.In 384, each group membership ignores s.

In 386, in the time interval i _l during this time, at least one base station arbitrarily bSito contact with BSN once in a while and momently.In 388, base station bSisuitable key will be passed through to use k _{u, bSi} identify and set up and each the not secure communication of impaired sensor node that forms a BSN part.In 390, base station will with the time interval i _{l+ 1} corresponding key certificate kC ^g _{l+ 1} distribute to each and identified sensor node.The same with scheme formerly, in the time interval i _l later, each base station bSiall ignore key certificate KC ^g _{l+ 1} .

In method 370, there are three kinds of special circumstances: first, if allow each base station bSionly add group once g _g , it just derives single key certificate so k ^g _{l+ 1} .Its effect is to have and group g _g as many different security domain. t=1 in particular cases, each base station bSiform the group of oneself g _i , thereby its effect is to have and base station bSias many different security domain.Secondly, if allow base station bSiadd nindividual different group g ₁, g ₂... g _n , 1< n≤ g, it is just derived so nindividual different key certificate kC ¹ _{l+ 1} , kC ² _{l+ 1} ... kC ⁿ _{l+ 1} .Its effect is to have different security domains, and some security domain logically connects.The 3rd, if all base stations are all interconnected to identical and unique group, they all agree to same key certificate so, thereby its effect is as the global safety territory in method 330.

In 392, set up key.If two nodes need to be set up pairwise key, they are first as the derivation pairwise key of being explained in method 300.Then, they check both have effective key certificate as the operation ZK agreement of passing through of being explained in method 270.Two sensor nodes with different key certificates can not be set up key.

In method 370, impaired sensor node can not be used for attacking the transducer with the different key certificate of the key certificate held from this impaired node.But, utilizing method 370, the sensor node with different key certificates can not carry out safe communication in same BSN.This key management system has the elasticity that improved anti-node is caught, and needn't rely on any Global ID of corresponding BSN, and the transducer memory capacity of the using memory capacity more required than basic cipher key pre-distribution scheme is slightly more.

With reference to preferred embodiment, invention has been described above.Once other staff read and understood detailed above description after may expect some modifications and improvement.The present invention it is pointed out that as long as within these modifications and improvement fall into the scope of appended claim or its equivalent, should be regarded as having comprised all such modifications and improvement.

Claims (7)

1. a method that is used for identifying the first sensor in movable sensor system, comprising:

From n-1 mutually orthogonal nrank Latin square set form limited projection plane ( n ²+ n+ 1, n+ 1,1), wherein nit is a prime power;

According to this finite projection plane, find public tpolynomial set share; And

According to the identifier of first sensor, by the second transducer, derived tpolynomial set share estimation point.

2. according to method claimed in claim 1, wherein secondary for the quadrature of described mutually orthogonal Latin square

unit in nindividual project, for each element e _m , m=1,2, nsequentially calculate the element of this orthogonal matrix

.

3. according to method claimed in claim 1, wherein said finite projection plane is to pass through structural matrix mconstruct described matrix mstructure by from the first row to the nrow is placed by its natural order n ²individual integer 1 n ²realize, wherein nit is a prime power.

4. according to method claimed in claim 1, further comprise:

Derive point p _v , at this some place node uestimate its tpolynomial set share f _k ( p _u , y) to generate key k _uv ;

According to described mutually orthogonal Latin square, construct described finite projection plane, make this finite projection plane before n ²individual element appears at nindividual successor block b _{1+ t} , b _{2+ t} , b _{n+ t} , t=0, n, 2 n, 3 n, n* neach group in occur once; And

According to piece label i, 1≤ i≤ n ²+ nand tpolynomial set label k, k≤ n ², derive counter occur s _k , wherein ka positive integer, nit is a prime power.

5. according to method claimed in claim 2, wherein transducer ucarry tpolynomial set share

label with b _i the element of ∈ FPP b _{i, 1} , b _{i, 2} , b _{i, n+ 1} become mapping one to one, wherein 1≤ i≤ n ²+ n+ 1, and wherein nit is a prime power.

6. according to method claimed in claim 3, wherein according to described mutually orthogonal Latin square, generate nthe affine plane AG on rank ^{(2, n)} , wherein (i) before nindividual piece b _i it is described matrix mrow, (ii) time nindividual piece is described matrix mrow, and (iii) by by each matrix

order is added to mupper and will with each matrix middle individual element

corresponding described matrix melement regard piece as and form remaining n ²- nindividual piece, wherein nit is a prime power.

7. a method that is used for maximizing extensibility, elasticity and the performance of wireless system, comprising:

Estimate associated with the node in this wireless system tpolynomial set share;

Will tpolynomial set share is distributed to the node of estimation in this wireless system; And

Via server is set to first node int and that communicate by letter and Section Point preassignment security key on this wireless system.

Images